Why do system user tokens last longer?
System user tokens behave differently from personal login sessions, which is why they can outlast the person who created them.
Is this your situation?
You set up a system user to connect software to your business assets, and now you wonder why its token does not expire like your own login. You want to know what that token can still do, and who controls it through auditing access.
What it is
A system user represents a server or software that makes API calls to assets owned or managed by a business portfolio. There are 2 types of system users. An admin system user can create system users. A regular system user can only access the assets it has permission for. Each new system user requires a newly generated token.
How Facebook handles this
- A system user token can only be shared once after it is generated.
- Each new system user requires its own newly generated token.
- A separate system user should be created for each type of access needed.
- The admin system user token should be carefully safeguarded because it has the most permissions.
- Use of the admin system user should be limited to administrative actions such as assigning permission.
Side by side
| Aspect | Admin system user | Regular system user |
|---|---|---|
| Creating system users | Can create system users. | Not stated by Facebook |
| Adding accounts | Can add accounts. | Not stated by Facebook |
| Assigning permissions | Can assign permissions. | Not stated by Facebook |
| Scope of access | Has the most permissions among system users. | Can only access the assets it has permission for. |
Common mistakes
- Treating one system user as general-purpose A separate system user should be created for each type of access needed.Why it happens: Reusing one system user seems simpler than setting up more than one.Already happened: If access may already be lost — Get Full Control of a Facebook Business Portfolio
- Overusing the admin system user Use of the admin system user should be limited to administrative actions such as assigning permission.Why it happens: Its broad access makes it tempting to use for routine API calls.
- Not safeguarding the admin token The admin system user token should be carefully safeguarded because it has the most permissions.Why it happens: A token shareable only once may be stored without a password's care.
If this changes who is in control
The admin system user token should be carefully safeguarded because it has the most permissions. You check who holds system user tokens when auditing access to the portfolio.
Quick reference
| Question | Answer |
|---|---|
| What is a system user? | It represents a server or software making API calls to managed assets. |
| How many system user types exist? | There are 2 types. |
| What can an admin system user do? | Create system users. |
| What can a regular system user access? | Only the assets it has permission for. |
| How many tokens per system user? | Each new system user requires a new generated token. |
| Can a token be re-shared? | A system user token can only be shared once. |
| Which token needs most care? | The admin system user token, because it has the most permissions. |
Frequently asked questions
Why does a system user token not expire like my login?
A system user represents a server or software that makes API calls to assets owned or managed by a business portfolio.
Should I use one system user for everything?
A separate system user should be created for each type of access needed.
What should I use the admin system user for?
Use of the admin system user should be limited to administrative actions such as assigning permission.
Can I get a new copy of a lost token?
Each new system user requires a new generated token.
Keeping track of who has access
Confusion builds when a token keeps working after the person who set it up has moved on, with no clear record of who holds it. Delvia keeps a clear picture of who holds which access, so nothing is left unaccounted for.
Was this helpful?